feat(providers): add Azure Foundry and Bedrock API-key connections

apps/desktop/src/main/__tests__/provider-endpoint-presentation.test.ts

@@ -25,7 +25,10 @@ import {
   providerEndpointPresentation,
 } from '../../renderer/settings/provider-endpoint-presentation.js';
 
-import { providerRequestUrlPreview } from '../../renderer/features/connection-settings/testing.js';
+import {
+  providerEndpointHelpKey,
+  providerRequestUrlPreview,
+} from '../../renderer/features/connection-settings/testing.js';
 
 // A 40-char hex-shaped run, built rather than written: long enough to trip
 // the display redactor's long-opaque-token rule wherever it is left alone.
@@ -215,6 +218,26 @@ test('draft request previews follow the relay protocol, custom prefixes and endp
     'https://relay.example/proxy/responses');
   assert.equal(providerRequestUrlPreview('custom', 'https://relay.example/', 'openai-responses'),
     'https://relay.example/responses');
+  assert.equal(providerRequestUrlPreview('azure-foundry', 'https://tenant.example/openai/v1'),
+    'https://tenant.example/openai/v1/chat/completions');
+  assert.equal(providerRequestUrlPreview('amazon-bedrock-api-key', 'https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1', 'openai-responses'),
+    'https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1/responses');
+});
+
+test('provider endpoint help follows the selected Azure and Bedrock API protocol', () => {
+  assert.equal(providerEndpointHelpKey('azure-foundry', 'openai-chat'), 'azureFoundryEndpointHelp');
+  assert.equal(
+    providerEndpointHelpKey('azure-foundry', 'anthropic-messages'),
+    'azureFoundryAnthropicEndpointHelp',
+  );
+  assert.equal(
+    providerEndpointHelpKey('amazon-bedrock-api-key', 'anthropic-messages'),
+    'bedrockAnthropicEndpointHelp',
+  );
+  assert.equal(
+    providerEndpointHelpKey('amazon-bedrock-api-key', 'openai-responses'),
+    'bedrockOpenAiEndpointHelp',
+  );
 });
 
 test('switching a custom connection protocol replaces the full OpenAI endpoint', () => {
@@ -238,5 +261,6 @@ test('empty, incomplete, unsaveable and unsupported protocol drafts have no requ
     assert.equal(providerRequestUrlPreview('custom', draft), null, draft);
   }
   assert.equal(providerRequestUrlPreview('openai', 'https://relay.example/v1'), null);
+  assert.equal(providerRequestUrlPreview('amazon-bedrock-api-key', 'https://bedrock-runtime.us-east-1.amazonaws.com/anthropic', 'anthropic-messages'), null);
   assert.equal(providerRequestUrlPreview('custom', 'https://relay.example/v1', 'anthropic-messages'), null);
 });

apps/desktop/src/renderer/features/connection-settings/provider-endpoint-field.tsx

@@ -24,6 +24,7 @@ import { getProviderSettingsCopy } from './settings-provider-copy.js';
 import { openAiChatUrl, openResponsesUrl } from '@maka/core/openai-urls';
 import { normalizeCatalogConnectionBaseUrl } from '@maka/core/runtime-policy';
 import { redactSecrets } from '@maka/core/display-redaction';
+import { providerSupportsApiProtocolSelection } from '@maka/core/llm-connections';
 
 export function ProviderEndpointField(props: {
   providerType: ProviderType;
@@ -33,26 +34,55 @@ export function ProviderEndpointField(props: {
 }) {
   const copy = getProviderSettingsCopy(useUiLocale()).shared;
   const url = providerRequestUrlPreview(props.providerType, props.baseUrl, props.apiProtocol);
-  if (props.providerType !== 'custom') return props.children(undefined);
+  const supportsPreview = providerSupportsApiProtocolSelection(props.providerType);
+  if (!supportsPreview) return props.children(undefined);
   const description = url ? `${copy.requestUrlLabel} ${url}` : undefined;
+  const endpointHelpKey = providerEndpointHelpKey(props.providerType, props.apiProtocol);
+  const endpointHelp = endpointHelpKey ? copy[endpointHelpKey] : undefined;
   // Astryx's description is above the input (and hidden with its label).
   // This computed output belongs below it; pass it through aria-description
   // on the control as well, without duplicating the field's visible label.
   return (
     <div className="providerEndpointField">
       {props.children(description)}
+      {endpointHelp && <p className="providerRequestUrlPreview">{endpointHelp}</p>}
       {description && <p className="providerRequestUrlPreview" aria-hidden="true">{description}</p>}
     </div>
   );
 }
 
+export function providerEndpointHelpKey(
+  providerType: ProviderType,
+  apiProtocol?: ModelApiProtocol,
+):
+  | 'azureFoundryEndpointHelp'
+  | 'azureFoundryAnthropicEndpointHelp'
+  | 'bedrockOpenAiEndpointHelp'
+  | 'bedrockAnthropicEndpointHelp'
+  | undefined {
+  if (providerType === 'azure-foundry') {
+    return apiProtocol === 'anthropic-messages'
+      ? 'azureFoundryAnthropicEndpointHelp'
+      : 'azureFoundryEndpointHelp';
+  }
+  if (providerType === 'amazon-bedrock-api-key') {
+    return apiProtocol === 'anthropic-messages'
+      ? 'bedrockAnthropicEndpointHelp'
+      : 'bedrockOpenAiEndpointHelp';
+  }
+  return undefined;
+}
+
 /** Preview the selected protocol when adding, or the default model's protocol when editing. */
 export function providerRequestUrlPreview(
   providerType: ProviderType,
   draftBaseUrl: string,
   apiProtocol: ModelApiProtocol = 'openai-chat',
 ): string | null {
-  if (providerType !== 'custom' || apiProtocol === 'anthropic-messages') {
+  if (
+    !providerSupportsApiProtocolSelection(providerType) ||
+    apiProtocol === 'anthropic-messages'
+  ) {
     return null;
   }
   // A draft must be a complete, saveable HTTP(S) address. Do not substitute

apps/desktop/src/renderer/features/connection-settings/settings-provider-copy.ts

@@ -273,6 +273,10 @@ const zhCopy = {
   },
   shared: {
     requestUrlLabel: '请求地址：',
+    azureFoundryEndpointHelp: '使用以 /openai/v1 结尾的已部署模型终结点。模型 ID 请填写部署名称；模型列表可能只包含基础模型。',
+    azureFoundryAnthropicEndpointHelp: 'Anthropic Messages 请使用 https://<resource-name>.services.ai.azure.com/anthropic。模型 ID 请填写部署名称。',
+    bedrockOpenAiEndpointHelp: 'Chat Completions 或 Responses 请使用 https://bedrock-runtime.{region}.amazonaws.com/openai/v1。若未列出，请手动输入 Bedrock 模型 ID。',
+    bedrockAnthropicEndpointHelp: 'Anthropic Messages 请使用 https://bedrock-runtime.{region}.amazonaws.com/anthropic。若未列出，请手动输入 Bedrock 模型 ID。',
     connectionStale: '连接状态已更新，请刷新列表后再删除。',
     actionFallback: '模型连接服务暂时不可用，请稍后重试。', rateLimit: '当前账号或模型服务触发速率限制，请稍后重试。',
     timeout: '请求超时，请检查网络或代理后重试。', unavailable: '模型服务暂时不可用，请稍后重试。',
@@ -486,6 +490,10 @@ const zhTwCopy = {
   },
   shared: {
     requestUrlLabel: '請求地址：',
+    azureFoundryEndpointHelp: '請使用以 /openai/v1 結尾的已部署模型端點。模型 ID 請填寫部署名稱；模型清單可能只包含基礎模型。',
+    azureFoundryAnthropicEndpointHelp: 'Anthropic Messages 請使用 https://<resource-name>.services.ai.azure.com/anthropic。模型 ID 請填寫部署名稱。',
+    bedrockOpenAiEndpointHelp: 'Chat Completions 或 Responses 請使用 https://bedrock-runtime.{region}.amazonaws.com/openai/v1。若未列出，請手動輸入 Bedrock 模型 ID。',
+    bedrockAnthropicEndpointHelp: 'Anthropic Messages 請使用 https://bedrock-runtime.{region}.amazonaws.com/anthropic。若未列出，請手動輸入 Bedrock 模型 ID。',
     connectionStale: '連線狀態已更新，請重新整理清單後再刪除。',
     actionFallback: '模型連線服務暫時不可用，請稍後重試。', rateLimit: '目前帳號或模型服務觸發速率限制，請稍後重試。',
     timeout: '請求超時，請檢查網路或代理後重試。', unavailable: '模型服務暫時不可用，請稍後重試。',
@@ -698,6 +706,10 @@ const enCopy: ProviderSettingsCopy = {
   },
   shared: {
     requestUrlLabel: 'Request URL:',
+    azureFoundryEndpointHelp: 'Use the deployed model endpoint ending in /openai/v1. Enter the deployment name as the model ID; the models list may only contain base models.',
+    azureFoundryAnthropicEndpointHelp: 'For Anthropic Messages, use https://<resource-name>.services.ai.azure.com/anthropic. Enter the deployment name as the model ID.',
+    bedrockOpenAiEndpointHelp: 'For Chat Completions or Responses, use https://bedrock-runtime.{region}.amazonaws.com/openai/v1. Enter the Bedrock model ID manually if it is not listed.',
+    bedrockAnthropicEndpointHelp: 'For Anthropic Messages, use https://bedrock-runtime.{region}.amazonaws.com/anthropic. Enter the Bedrock model ID manually if it is not listed.',
     connectionStale: 'The connection changed while deleting. Refresh the list and try again.',
     actionFallback: 'The model connection service is temporarily unavailable. Try again later.', rateLimit: 'This account or model service is rate-limited. Try again later.',
     timeout: 'The request timed out. Check the network or proxy and try again.', unavailable: 'The model service is temporarily unavailable. Try again later.',

apps/desktop/src/renderer/features/connection-settings/testing.ts

@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { providerRequestUrlPreview } from './provider-endpoint-field.js';
+export { providerEndpointHelpKey, providerRequestUrlPreview } from './provider-endpoint-field.js';

apps/desktop/src/renderer/settings/provider-add-form.tsx

@@ -24,6 +24,7 @@ import {
   MODEL_API_PROTOCOLS,
   PROVIDER_REGISTRY,
   deriveConnectionSlug,
+  providerSupportsApiProtocolSelection,
 } from '@maka/core/llm-connections';
 import {
   providerAuthRequiresSecret,
@@ -132,6 +133,7 @@ export function AddProviderForm(props: {
   }>({ baseUrl: defaults.baseUrl, defaultApiProtocol: 'openai-chat' });
   const { baseUrl, defaultApiProtocol } = endpoint;
   const isCustom = props.providerType === 'custom';
+  const canChooseApiProtocol = providerSupportsApiProtocolSelection(props.providerType);
   const [cloudflareAccountId, setCloudflareAccountId] = useState('');
   const [apiKey, setApiKey] = useState('');
   const [defaultModel, setDefaultModel] = useState(recommendedDefaultModel);
@@ -383,7 +385,7 @@ export function AddProviderForm(props: {
         name: name || display.name,
         providerType: props.providerType,
         baseUrl: resolvedBaseUrl,
-        ...(isCustom ? { defaultApiProtocol } : {}),
+        ...(canChooseApiProtocol ? { defaultApiProtocol } : {}),
         defaultModel: createdDefaultModel,
         ...(normalizedApiKey ? { apiKey: normalizedApiKey } : {}),
         ...(Object.keys(normalizedRequestHeaders).length > 0
@@ -782,7 +784,7 @@ export function AddProviderForm(props: {
             )}
           </ProviderEndpointField>
         )}
-        {isCustom && (
+        {canChooseApiProtocol && (
           <Selector
             label={copy.connectionApiProtocol}
             description={copy.connectionApiProtocolHelp}

apps/desktop/src/renderer/settings/provider-display-copy.ts

@@ -259,6 +259,16 @@ export const PROVIDER_DISPLAY_COPY = {
     'zh-TW': { name: 'Cloudflare Workers AI', description: 'Cloudflare 託管模型，使用帳號層級連線', badge: 'API' },
     en: { name: 'Cloudflare Workers AI', description: 'Cloudflare-hosted models over the account-scoped API.', badge: 'API' },
   },
+  'azure-foundry': {
+    'zh-CN': { name: 'Azure AI Foundry', description: '使用 Foundry 终结点和 API 密钥连接已部署的 OpenAI 兼容模型。', badge: 'API' },
+    'zh-TW': { name: 'Azure AI Foundry', description: '使用 Foundry 端點與 API 金鑰連線已部署的 OpenAI 相容模型。', badge: 'API' },
+    en: { name: 'Azure AI Foundry', description: 'Connect a deployed OpenAI-compatible model with its Foundry endpoint and API key.', badge: 'API' },
+  },
+  'amazon-bedrock-api-key': {
+    'zh-CN': { name: 'Amazon Bedrock（API 密钥）', description: '使用 Bedrock API 密钥和区域 OpenAI 兼容端点连接模型；可为 Responses 或 Anthropic Messages 模型选择对应协议。', badge: 'API' },
+    'zh-TW': { name: 'Amazon Bedrock（API 金鑰）', description: '使用 Bedrock API 金鑰與區域 OpenAI 相容端點連線模型；可為 Responses 或 Anthropic Messages 模型選擇對應協定。', badge: 'API' },
+    en: { name: 'Amazon Bedrock (API key)', description: 'Use a Bedrock API key with its regional OpenAI-compatible endpoint and select Responses or Anthropic Messages for models that require them.', badge: 'API' },
+  },
   huggingface: {
     'zh-CN': { name: 'Hugging Face', description: 'Inference Providers 路由，聚合多家托管模型', badge: '路由' },
     'zh-TW': { name: 'Hugging Face', description: 'Inference Providers 路由，聚合多家託管模型', badge: '路由' },

packages/core/src/__tests__/provider-catalog-contract.test.ts

@@ -31,6 +31,8 @@ import {
 import {
   CATALOG_PROVIDER_TYPES,
   PROVIDER_REGISTRY,
+  providerSupportsApiProtocolSelection,
+  providerSupportsDefaultApiProtocol,
   isRetiredProvider,
   providerAcceptsOutputTokenLimit,
   providerFallbackModelIds,
@@ -66,6 +68,57 @@ describe('Moonshot provider regions', () => {
 });
 
 describe('provider catalog contract — structural invariants over CATALOG_PROVIDER_TYPES', () => {
+  it('derives protocol picker availability from endpoint-owned registry entries', () => {
+    assert.equal(providerSupportsApiProtocolSelection('custom'), true);
+    assert.equal(providerSupportsApiProtocolSelection('azure-foundry'), true);
+    assert.equal(providerSupportsApiProtocolSelection('amazon-bedrock-api-key'), true);
+    assert.equal(providerSupportsApiProtocolSelection('openrouter'), false);
+    assert.equal(providerSupportsApiProtocolSelection('opencode'), false);
+    assert.equal(providerSupportsDefaultApiProtocol('azure-foundry', 'openai-chat'), true);
+    assert.equal(providerSupportsDefaultApiProtocol('azure-foundry', 'openai-responses'), true);
+    assert.equal(
+      providerSupportsDefaultApiProtocol('amazon-bedrock-api-key', 'anthropic-messages'),
+      true,
+    );
+    assert.equal(providerSupportsDefaultApiProtocol('openrouter', 'openai-chat'), false);
+  });
+
+  it('marks tenant- or region-scoped API providers as user-endpoint connections', () => {
+    for (const type of ['azure-foundry', 'amazon-bedrock-api-key'] as const) {
+      const definition = PROVIDER_REGISTRY[type];
+      assert.equal(definition.authKind, 'api_key');
+      assert.equal(definition.baseUrl, '');
+      assert.ok(
+        definition.runtimeAdapter.kind === 'openai-compatible' &&
+          definition.runtimeAdapter.requireBaseUrl,
+      );
+      assert.equal(definition.category, 'custom');
+      assert.deepEqual(Object.keys(definition.protocolAdapters ?? {}).sort(), [
+        'anthropic-messages',
+        'openai-responses',
+      ]);
+    }
+  });
+
+  it('declares a working runtime adapter for every selectable API protocol', () => {
+    for (const type of ['azure-foundry', 'amazon-bedrock-api-key'] as const) {
+      const definition = PROVIDER_REGISTRY[type];
+      assert.equal(definition.runtimeAdapter.kind, 'openai-compatible');
+      assert.deepEqual(definition.protocolAdapters?.['openai-responses'], {
+        kind: 'openai',
+        apiProtocol: 'openai-responses',
+        responses: { adapter: 'openai', reasoningReplay: 'encrypted-content' },
+      });
+      assert.deepEqual(definition.protocolAdapters?.['anthropic-messages'], {
+        kind: 'anthropic',
+        // Bedrock's documented Anthropic endpoint accepts the API key in
+        // x-api-key, as does the Azure Foundry endpoint.
+        auth: 'api-key',
+        normalizeBaseUrl: true,
+      });
+    }
+  });
+
   it('exposes an endpoint source that passes the production baseUrl gate', () => {
     for (const type of CATALOG_PROVIDER_TYPES) {
       const def = PROVIDER_REGISTRY[type];
@@ -174,6 +227,16 @@ describe('provider catalog contract — structural invariants over CATALOG_PROVI
           compatibility: 'alibaba-token-plan',
         },
       },
+      {
+        providerType: 'azure-foundry',
+        via: 'protocolAdapters.openai-responses',
+        contract: { adapter: 'openai', reasoningReplay: 'encrypted-content' },
+      },
+      {
+        providerType: 'amazon-bedrock-api-key',
+        via: 'protocolAdapters.openai-responses',
+        contract: { adapter: 'openai', reasoningReplay: 'encrypted-content' },
+      },
       {
         providerType: 'custom',
         via: 'protocolAdapters.openai-responses',

packages/core/src/__tests__/runtime-policy-codec.test.ts

@@ -439,7 +439,8 @@ test('relay model profiles round-trip canonical entries and drafts, strictly', (
     null,
   );
 
-  // A custom connection needs a default wire; no other provider may carry one.
+  // Custom endpoints and the new protocol-flexible catalog entries can store
+  // a chosen default wire; other providers still cannot claim unsupported wires.
   const custom = {
     slug: 'relay',
     name: 'Relay',
@@ -454,15 +455,37 @@ test('relay model profiles round-trip canonical entries and drafts, strictly', (
     [withoutProtocol, /default API protocol is invalid/],
     [{ ...custom, defaultApiProtocol: 'google-generate' }, /default API protocol is invalid/],
     [
-      { ...custom, providerType: 'openai', baseUrl: undefined },
-      /only a custom connection has a default API protocol/,
+      { ...custom, providerType: 'anthropic', baseUrl: undefined },
+      /provider does not support this default API protocol/,
     ],
   ] as const) {
     assert.throws(
       () => normalizeCreateCatalogConnectionInput({ expectedCatalogRevision: 0, connection }),
       message,
     );
   }
+  for (const providerType of ['azure-foundry', 'amazon-bedrock-api-key'] as const) {
+    for (const defaultApiProtocol of [
+      'openai-chat',
+      'openai-responses',
+      'anthropic-messages',
+    ] as const) {
+      assert.doesNotThrow(() =>
+        normalizeCreateCatalogConnectionInput({
+          expectedCatalogRevision: 0,
+          connection: {
+            slug: providerType,
+            name: providerType,
+            providerType,
+            baseUrl: 'https://provider.example/openai/v1',
+            defaultApiProtocol,
+            enabled: true,
+            enabledModelIds: [],
+          },
+        }),
+      );
+    }
+  }
   assert.deepEqual(
     normalizeConnectionCatalogEntryUpdate({
       name: 'Relay',

packages/core/src/llm-connections.ts

@@ -45,6 +45,8 @@ import {
   providerDefaultsOf,
   providerFallbackModelIds,
   providerMenuLabel,
+  providerSupportsApiProtocolSelection,
+  providerSupportsDefaultApiProtocol,
   type ApplyPatchProtocol,
   type ModelApiProtocol,
   type OpenResponsesCompatibilityProfile,
@@ -67,6 +69,8 @@ export {
   providerDefaultsOf,
   providerFallbackModelIds,
   providerMenuLabel,
+  providerSupportsApiProtocolSelection,
+  providerSupportsDefaultApiProtocol,
 };
 export type {
   ApplyPatchProtocol,